kern/44273: iwn / wpa_supplicant crash kernel

[bch%methodlogic.net@localhost]

>Number:         44273
>Category:       kern
>Synopsis:       iwn / wpa_supplicant crash kernel
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Dec 23 22:35:00 +0000 2010
>Originator:     Brad Harder
>Release:        5.99.41
>Organization:
Method Logic Digital (http://methodlogic.net/)
>Environment:
NetBSD kamloops 5.99.41 NetBSD 5.99.41 (kamloops) #123: Wed Dec 22 20:11:25 PST 
2010 root@kamloops:/usr/obj/sys/arch/amd64/compile/kamloops amd64
>Description:
Connecting wirelessly to dlink "dap 1360 (hw ver B1, fw ver 2.10)" wireless 
router crashes kernel. Transcribed (carefully, but may contain errors) 
stacktrace:

panic: not enough data in following buffer, m_len 1 need 3
fatal breakpoint trap in supervisor mode
trap type 1 code 0 in rip ffffffff80207f75 cs 8 rflags 246 cr2 7f7ffd01a4a7 cpl 
6
rsp ffff30004602a860
Stopped in pid 0.3 (system) at netbsd: breakpoint+0x5: leave

> bt
breakpoint() at netbsd: breakpoint+0x5
panic() at netbsd: panic+0x2ba
michael_mic() at netbsd:michael_mic+0x5b1
tkip_enmic() at netbsd:tkip_enmic+0xa0
ieee80211_encap() at netbsd:ieee80211_encap+0x7ac
iwn_start() at netbsd:iwn_start+0x969
ifq_enque() at netbsd:ifq_enque+0xb3

[simplified trace follows...]
ether_output()...
in_arpinput()...
arpintr()...
softint_dispatch()...
Xsoftintr()...
>How-To-Repeat:
connect to above-mentioned wiresless router, try to transfer "large" amount of 
data ("cvs update -Pd" of /usr/src, for example).
>Fix: